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Mr. William E. Colby 
Director, Central Intelligence 
Washington, D.C. 20505 

Dear Mr, Colby: 

We are pleased to submit to you a report o£ bur 
review of the Agency’s internal audit functions. Our 
review was conducted in accordance with our proposal 
dated October 9, 1973, and the provisions of contract 
XG- 3882 (1201-AS-5) 74P , dated October 15, 1973. 

Very truly yours, 
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Certified Public Accountants 


TOUCHE ROSS 
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HIGHLIGHTS 


The results of our review of internal auditing in the CIA 
are presented in detail in the following report. Some of our 
conclusions include: 


ILLEGIB 


the overall internal audit effort in CIA is adequate 
to safeguard A.gency assets and ensure administrative 
compliance with laws and regulations. 

Agency auditors are generally well-qualified, well-trained, 
professionally competent and, for the present, adequate 
in numbers. 

to conform to overall federal policy, and to more effectively 
use the audit resources available, Agency management should 
encourage broader audit coverage of the economy, efficiency 
and effectiveness with which its programs are carried out, an< 
consider modifying its policy requiring annual financial audi 
of all activities. 


/M 
/ 1 f/Y 

i/yy /, . - / 
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, Agency management should capitalize on a ready. source of 
management talent by considering upper level auditors for 
management positions in operational areas. 

- articulated quality assurance policies, would help to 
maintain high standards for audit performance. 

- continued operation of the Audit Staff covert public 
accounting firm may become uneconomic if changes are made 

* in the Agency audit policy. 

( the ' Commercial Systems and Audit Division may be able to 

1 shift the emphasis of its audits somewhat to provide more 

I useful information to procurement personnel. 
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BACKGROUND 


Two related factors directly affect the chararte 

Ac'- of C ?q?Q l £Unctl0I V The first is the Central 

f 949 » which grants the Director 
(DC!) the authority 

over his certification that such expend! tiiT?" 7 

extraordinary , or emergency nature, wir ho,,,' tCli,°C a N° nj lo " ai:ia 
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' 7 ™ ^Pf na sums made available to the Agency 



in a 


strong 


The combination of these two factors resulted 
desire on the part of early Agency management to establi-h v* th m-« 
Congress a baseline of confidence in the integrity of the p-C-l i u 
operation of the Agency. Agency management believed that -• a- 

operating practices, though necessary, would be difficult to 1 A 
retam if substantial financial improprieties oenrr 5 T i° * 
they insisted on financial audits of eye^ Agency ew^ditS^ 6 ’ 
every year in the belief that such audits AculS help P ins«e 

Cong?estioEa? P he«ings d W ° Uld b ° 3 COmrinCing item to P° ir “ t» in 

Agency"foJ Co^hs's! cSd™i.d C ;Sdi^f°fSS ,, £l“.Si”S;J 8ht ' 
particularly those relating to the "vouchered" overt exJSditur^ 

^n JUn A°! a ?, 6 U aft V a period of confrontation and nSgoUa«pn 
ceased all its CIA audit activities because the Comptroller ’ 
General did not believe his staff had sufficient access to 
effectively accomplish its audit objectives, GAO believed its 
puipose was to determine how well the Agency or activity und-er 
audit had ^accomplished the purposes it was authorized to accomplish 

flJja°^ h + e ' ; ‘t 1C;Lei J t j and economi cal use of funds, people and property ' 
and that it needed access to information about all CIA operations in 
order to do so. The Director of the CIA, on the other hand 
believed the Congress intended to exempt the CIA's confidential 

"romnr££J! ,n f 11 „ rev: J-? w » and that to permit GAO to conduct a 
comprehensive’ audit would compromise the necessary oaor-tinni 

security As a result of GAO ' s withdrawal from h/audlt^f Sf 
CIA operations, the CIA Audit Staff assumed final audit i^esjon- 
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sibilitv for all CIA activities and funds. 


Stafr 


^lhe current CIA audit policy states that the Chief, Audit 
r is responsible for performing final independent audits 
annually, or as often as he deems necessary, of all Agency 
act.ivit.ies, including headquarters components, proprietary and 
ouner projects, domestic and overseas field stations, and 
all Agency- sponsored activities, such as the Federal Credit Union 
oi employee health and insurance plans. The policy requires 
auGit procedures necessary to (1) ascertain that controls and 
records are adequate to assure proper safeguarding, use of, and 
accounting for Agency . assets ; and. (2) verify compliance with 
applicable law, policies, regulations, and procedures. The Chief 
Audit Statf is required to report any Agency activities found, 
as a result of audit, to be uneconomical, inefficient, or improper 

in ^rnal audit practices developed then, in. an environ 
men l . that demanded . annual financial audit of every Agency activity 
and in which oversight evaluation by the General Accounting Office 
°, n °n~ e xistent . Audit plans, programs and procedures 
were all developed with the goal of ensuring complete annual 
coverage of financial activities of all organizational elements. 
Limited emphasis was. given to matters of Agency efficiency 

and economy, and no audits specifically of program effectiveness 
were conducted prior to late 1973. 

Agency audit functions are performed by two separate organi- 
zations; the Inspector General Audit Staff, and the Commercial 
Systems and Audit Division, Office of Finance. The Inspector 
General Audit Staff performs a ’’post-audit” function for all 
Agency activities, whereas Commercial Systems and Audit Division 

^ dl i S + S re part ° f t 5 e P rocu rement process, providing information 
about the accuracy of direct costs charged to Agency contracts. 

More detailed explanations of the functions of each group are 
contained in later sections of this report. 

The Inspector General Audit Staff (hereinafter referred to 
as the Audit Staff) is currently authorized positions for 39 
professional . auditors and 6 secretaries. Organizationally, the 
Audit Staff is part of the Inspector General’s staff and reports 
through him to the. Director of Central Intelligence. In calendar 
the Au ^it Staf^issued 265 reports covering the audit 
* ie f ( - lciuarters and ^^Boverseas activities and stated it had 
either audited or was in. the process of auditing all Agency 

* (9 u :f com parison of Audit Staff audit coverage with 

the CIA financial . report provided us by the Chief, Audit Staff 
indicated the Audit Staff audits did include substantially all* 
Agency activities.) 1 
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The following analysis illustrates the Audit Staff workload \ 
for fiscal year 1974.' \ 


Directorate 


Operations 

Support ...... 

Science and Technology 
Intelligence .... 

Office of Director . 


Non-appropriated Funds 
Support (Credit -Union, 
GEHA, etc.). . . . 


Total 


The analysis shows that the Audit Staff workload is roughly 
proportional to overall Agency expenditures other than Science and 
Technology expenditures. Such expenditures amounted to BHHHHH 
of the total ^ dollars audited and 11.3 percent of the Audit Staff 
man-days available. This is explained in part, by the Audit Staff's 
orientation toward auditing each point of expenditure regardless 
of the amounts involved and in part by the large dollar volume 
of the individual contracts that represent the bulk of Science 
and Technology expenditures. 

- The Audit "Staff is organized into three functional groups 
related to the overall Agency organization as illustrated on the 
following page. This organization is designed to provide optimum 
communication between the Audit Staff and the organizations 
subj ect to au dit : ---■ - ' ~ 

Commercial Systems and Audit Division 

, . The other audit organization within CIA is a division of the 
Office of Finance which does interim and final audits of all t he 
Agency's negotiated contracts other than 

CSAD consist^o^2^cos^aud^o^^nd 5 admxna^r^iT^emp^ye e s , 
and audited contf actors- during* fiscal " 

197 3.- C5AB- audits direct materials and labor costs for 
contracts at least once prior to final payment. 


FY 74 

Man Per- 

Days cent 


Appropriated 
Funds and 
Advances from 
Other Agencies, 
FY 7 3 
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Per- 

cent 
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100.0 


25X1 A 


100.0 
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SCOPE 

Our review was undertaken at the request of the Agency, 
to determine whether the overall audit process within the Central 
Intelligence Agency is adequate. Our understanding of the stan- 
dard to be applied in determining "adequacy,” is that it is that 
amount of audit necessary to achieve results comparable to those 
that would be achieved if the Agency were subject to audit by a 
central audit authority. To accomplish our objective we reviewed: 

(a) internal auditing standards for federal agencies as 
promulgated by the General Services Administration Office 
of Federal Management Policy, the Office of Management and 
Budget, and the United States General Accounting Office. 

(b) CIA audit policies in the light of authorizing legislation 
and as stated in implementing regulations. 

(c) the scope of audit activities actually carried out within 
the Agency including (1) the programs followed; (2) 

the evidence-collection and summarization techniques in 
use; (3) the reporting practices followed; and (4) other 
aspects of technical performance as we considered necessary. 

(d) the technical qualification of the Agency’s auditors, 
their adequacy to meet Agency audit objectives, and the 
adequacy of training and professional development. 

(e) management practices followed within the Agency's 
audit organizations, to determine whether staff are used 
efficiently and effectively. 

Determining Standards 

Notwithstanding its special operating arrangements, CIA 
is part of the executive branch of government. Agency management 
has consistently stated that their intention is to conduct CIA 
operations as much like any other executive agency as possible, 
subject to the same constraints and objectives. For this reason, 
we sought t.o identify standards and regulations within the federal 
government that describe the functions to be performed through 
audit. 

The Budget and Accounting Act of 1950 redefined the role of 
auditing somewhat, and provides the legal framework for auditing 
in the federal government. The United States General Accounting 
Office, a congressional agency, is the central audit authority in 
the federal government and, as such, exerts strong influence on 
internal auditing in executive agencies. The Office of Federal 
Management Policy, General Services Administration, prescribes 
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auditing policy for the executive branch (it was preceeded in this 1 
function by the Office of Management and Budget). Finally, CIA's \ 
own enabling legislation and operating regulations define ■ 

specifically, Agency management’s standards. 

We believe there are four sources particularly useful in 
determining federal internal audit standards. Chronologically 
they are as folloiv’s: 

(1) A booklet entitled Internal Auditing: A Statement of 
Principles a nd Concepts , published by The General 
Accounting Office in 1957. 

(2) A revision of the first GAO booklet entitled Internal 
Au dit in g in Federal Agencies: A Statement of Basic 
Pr inciples and Concepts , 'published in 196'5~! 

(3) A booklet entitled Standards for Audit of Government 
Pro grams, Organizations - ,' Functions and Activities 
published by GAO in July 1972. 

NOTE: The three booklets listed are not binding on executive 

branch agencies, but are suggestive of the standards applied by 
GAO in its evaluations of federal practices, and, more 
specifically, of internal audit organizations. 

(4) Federal Management Circular 73-2, "Audit of Federal 
Operations and Programs by Executive Branch Agencies," 
dated September 27, 1973. 

Headquarters regulations established CIA standards for 

internal audit. 


As a final element of criteria, we used the experience we 
have gained in operating our own audit practice, both in the 
areas of administration and management and in technical performance. 

Assessment of CIA Internal Audit Activities 

CIA has two organizational elements that conduct audits, 

(1) the Inspector General’s Audit Staff, and (2) the Commercial 
Systems and Audit Division of the Office of Finance. In our 
reviews of both elements determined what audits they perform, 
how they went about their audits, and what results were produced. 

We examined a representative cross-section of recent audits in 
detail to determine (1) the adequacy and applicability of audit 
programs used, (2). the adequacy of evidence collection and 
presentation as represented by the audit working papers, and (3) 
the appropriateness of reports resulting from the audits. 

The schedule on the following page lists the specific audits 
selected for reviexv'. In each case, we reviewed in depth the most 
recent audit available, and also audits of past years to evaluate 
consistency. Specific technical comments resulting from our reviews 
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This report contains our observations resulting from. j 
comparison of the audit activities we reviewed with the standards j 
which we believe are applicable, j 
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SUMMARY f 

| 

Our review of the operations of the Agency's audit or^ani- ! 

zations has shown they perform a thorough audit at least annually f 

of all the Agency's financial transactions, and provide management 
useful information concerning the efficiency and economy of some 
elements of Agency operations. The Audit Staff is generally 
well - trained , competent and well - organized , and occupies a 
position in the Agency management hierarchy that gives it 
independence in planning, programming, executing, and reporting 
on reviews of all Agency activities. We believe, however a 
number of opportunities for improvement exist, including greater 
emphasis on program performance auditing, better use of management 
talent developed through participation in the Audit Staff activities 
and improved quality control within the Audit Staff. 

^ Our review of CSAD indicated they perform adequate audits ! 

of direct materials and labor charged to CIA contracts, but that 
some opportunities for improvements in quality control ’and efficiency 
are rc!n thy J ° £ consideration. We also found indications that a shift 
m CSAD audit emphasis may enhance its effectiveness as an aid to 
the procurement process. 

Organization of this Report 

For the convenience of the reader, we have organized our retort 
into several sections. The first outlines areas in which we believe 
the Audit Staff’s. existing operations are satisfactory. The second 
outlines opportunities for improving Audit Staff operations and 
policies. The third . section . contains our observations on the 
operation of the. Off ice of Finance's Commercial Systems and Audit 
Division. And finally, the appendices provide our specific 
comments on and suggestions for improving technical aspects of 
audit operations (we believe these sections will be useful mainly - 

Chiefs , Audit Staff and CSAD). Some of the issues more j 

fully developed in the report are: j 

Areas of Satisfactory Performance 

* ■ ■ j 

} 

the. Audit Staff is organizationally independent and has ; 

a direct line of communication with the Agency Director. ! 

- Agency management has been generally responsive to Audit j 

Staff reports and findings and has taken corrective action I 

where appropriate. j 

- the Audit Staff is generally well -qualified , well-trained 
professionally competent, and, for the present, adequate in ; 
numbers. The Audit Staff training and development policy 

has . encouraged its employees to remain abreast of current ; 

audit techniques and prepare for new areas of emphasis. 
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\ 

- financial and compliance audits are thorough and comprehensivl 

- the Audit Staff is well -prepared to audit ADP activities. j 

t 

O pportunities for Improvement j 

- Agency policy presently emphasizes financial and compliance 
auditing. To conform to overall federal policy, and' to more ! 
effectively use the staff resources available on the Audit 
Staff, Agency management should encourage audits of the 

• economy, efficiency and effectiveness of Agency programs. 

- closer coordination between the Inspections Staff and Audit 

Staff, particularly in program performance areas (economy, 
efficiency, effectiveness), would enhance overall management j 
review. j 

i 

- Agency management could capitalize on a ready source 

of management talent by considering upper level Audit Staff 
employees for management positions in operational areas. In 
addition to the primary benefit of gaining highly trained 
management talent, turnover incident to reassignment would 
provide continuing avenues for training and growth within 
the Audit Staff. 

- an articulated policy for quality assurance, including 
independent working paper and report review, would help to 
insure sustained high quality of Audit Staff performance. 

I 

- a counseling program, if properly conceived and carried j 

out, could help staff members better understand organizational: 
goals and where they stand in relation to the organization. ! 

i 

- if the CIA audit policy requiring annual audits of all 
activities is changed, the continued operation of the 

Audit Staff's covert public accounting firm may be uneconomic.! 

- the Commercial Systems and Audit Division, Office of Finance, 
may be able to shift the emphasis of its audits somewhat to 
provide more useful information to procurement personnel. 

In addition, opportunities for improvement in evidence 
collection techniques and quality control are worthy of 
consideration. 
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